Late patching of Metabase SQLi bug claims Sydney's Mathspace

A critical vulnerability in the Metabase business intelligence (BI) tool was exploited by unknown attackers to breach online mathematics learning platform Mathspace.

Although Metabase issued a security advisory on August 7, advising customers to upgrade their self-hosted installations immediately, Mathspace founder and chief technology officer (CTO) Alvin Savoy said this wasn't done.

"Our existing vulnerability-notification process did not identify and escalate that advisory for action," Savoy said.

"We updated our instance on August 29 after a later Metabase notice came to our attention."

That delay in patching was enough for attackers gain access to Mathspace's Metabase instance, and steal data.

Savoy said a range of data was taken, for students, staff and for parents and guardians.

This includes user ID, usernames, first and last names, email addresses as well as other information relating to logins.

Trivially exploitable critical SQLi bug

The Metabase vulnerability carries a maximum severity rating of 10.0 out of 10 possible, and is easy to exploit.

It allows structured query language (SQL) command injection through the /api/session/reset_password page and allows a remote attacker to gain administrator access to the Metabase instance without providing any credentials.

A wide range of Metabase versions are affected by the vulnerability, from x.58.0 to x.63.0.

Laptop maker Framework, Python data science platform Anaconda, and form builder tool Tally have all disclosed unauthorised data access due to the vulnerability, which affected the three companies' cloud-hosted Metabase instances.

Real-time threat and risk intelligence provider Dataminr assessed that in the first week of August just over 4300 hosts reachable over the Internet were running vulnerable versions of Metabase.

It said many of the organisations were in the government, healthcare, energy, finance, telecom, aviation and public sectors.

Savoy said Mathspace has notified schools and individuals affected by the breach, as well as authorities such as the Office of the Australian Information Commissioner, the Australian Signals Directorate's Australian Cyber Security Centre, and their counterparts in New Zealand.

Mathspace was founded by Savoy, Mohamad Jebara and Chris Velis in Sydney in 2010, and is used by schools in Australia, New Zealand, the United States, Canada, the United Kingdom, Hong Kong and India.

The current data breach only affected Australian and New Zealand users, however.

Savoy warned Mathspace users to be cautious about messages impersonating the platform, schools and other familiar organisations, using the captured data.